EUVD-2026-105578
GHSA-jv6p-5m2g-gc8g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
ExploitLure victim to open in Chrome
-
ExecutionTrigger Downloads input-validation flaw
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires a victim running Google Chrome prior to 156.0.8078.47 to actively visit or load attacker-controlled crafted HTML (CVSS UI:R), abusing improper input validation in the Downloads component; no authentication or special non-default configuration is required (PR:N). Key limiting factor: successful exploitation yields code execution only INSIDE the renderer sandbox (S:U, per the description), so full host compromise additionally requires a separate sandbox-escape vulnerability - this containment, plus the required user interaction, meaningfully constrains real-world impact despite the network vector. |
| Impact | The input assigns CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating a network-reachable, low-complexity, unauthenticated flaw requiring only user interaction (visiting a page). However, two signals pull the real-world priority down from the raw 8.8: the vendor (Chromium) rated this security severity 'Medium', and the description explicitly states code execution occurs 'inside the sandbox' - meaning a successful exploit yields only renderer-sandboxed code execution, not full host compromise, unless chained with a separate sandbox-escape bug. No EPSS score was provided, there is no CISA KEV listing, and no public POC is referenced, so there is no evidence of active or imminent widespread exploitation. The CVSS vector and description are consistent (both imply remote web-based delivery with user interaction), so there is no attack-vector conflict to flag. Net assessment: this is a standard high-CVSS browser bug whose practical risk is tempered by sandbox containment and the Medium vendor rating; it is a routine patch-management priority given Chrome's ubiquity, but not an emergency absent exploitation evidence or a paired escape. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that abuses improper input validation in Chrome's Downloads handling. A victim using a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, and the flaw is triggered to run attacker-controlled code within the renderer sandbox; full system compromise would additionally require a sandbox-escape vulnerability. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Improper input validation in the Downloads component of Google Chrome prior to 156.0.8078.47 lets a remote attacker who convinces a user to load a crafted HTML page (CVSS UI:R, PR:N) achieve arbitrary code execution, though only within the renderer sandbox - full host compromise would require chaining a separate sandbox escape. Google rates the issue Medium (Chromium severity), while the CVSS 3.1 vector scores 8.8 due to high confidentiality and integrity impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later via the Stable Channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and verify the version in chrome://settings/help (or the enterprise version pin). Because exploitation requires a user to load crafted HTML, interim risk reduction includes enforcing automatic browser updates, restricting untrusted web content and drive-by download paths through enterprise URL filtering/proxy policies, and enabling site isolation and renderer sandboxing so that any code execution stays inside the sandbox - noting that these controls reduce exposure but do not eliminate the flaw and can break legitimate download workflows if overly restrictive. No public exploit code was identified, so patching can follow normal cadence, but prioritize given the network vector and high C/I impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-20 (Improper Input Validation) in Chrome's Downloads subsystem means the browser fails to adequately validate data it processes while handling download-related content, allowing a crafted HTML page to drive the vulnerable logic into memory-unsafe or unintended behavior and ultimately execute arbitrary code. The affected surface is Chrome's download handling plus the renderer that parses attacker-supplied HTML, and the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) indicates a network-reachable, low-complexity flaw requiring no credentials but mandating victim interaction, with the scope unchanged - i.e. the compromise is contained to the renderer's sandbox rather than the OS. Per EUVD, all Chrome builds below 156.0.8078.47 are affected; fixing requires the stable-channel update to 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N; visiting the page is UI:R; sandboxed renderer code execution keeps S:U with full C:H/I:H/A:H within the renderer process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain an improper input validation flaw in the Downloads component that can allow a remote, unauthenticated attacker to achieve code execution within the browser’s renderer sandbox if a user loads a crafted HTML page. The practical business risk is concentrated in user browsing behavior and browser data confidentiality/integrity rather than direct host takeover, because full compromise would require a separate sandbox escape; no public exploit identified at time of analysis. Leadership should care because Chrome is broadly deployed and a vendor patch is available, making rapid update and verification a manageable risk-reduction priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB